S2.09 - Organisational_legitimacy

S2.09 ? Organisational legitimacy

flowchart LR
    A[Traditional AI governance: policy claims, assurance rhetoric, weak proof] --> B[RAIDT - run-level evidence framework]
    B --> C[[Organisational legitimacy]]
    B --> D[Run-level evidence pack]
    B --> E[RAIDT five-pillar score profile]
    C --> F[Credible justification of GenAI use]
    C --> G[Reviewability and contestability]
    D --> H[Reviewer reconstruction]
    E --> I[Governance readiness]
    F --> I
    G --> I
    J[Public services]
    K[Healthcare]
    L[Finance]
    M[Education]
    N[Enterprise productivity]
    J --> C
    K --> C
    L --> C
    M --> C
    N --> C

? Star S2 - Governance Meaning and Problem Context

Star context: Clarifies governance as oversight, control, accountability, reviewability and continuous improvement rather than a vague ethics label. In RAIDT, organisational legitimacy is the point at which those governance claims become credible because they can be evidenced at run level rather than merely asserted in policy language.

Academic picture

Definition / background

Organisational legitimacy refers to the extent to which an organisation's actions are seen as appropriate, credible, and justifiable within its institutional, professional, and social context. In governance terms, legitimacy is not only about whether an organisation believes it is acting responsibly; it is about whether others can recognise that responsibility through visible processes, defensible records, and accountable practice.

In GenAI governance, this distinction matters because organisations increasingly rely on systems that generate outputs with limited transparency, variable reliability, and context-sensitive risks. A policy saying that a model is used responsibly does not by itself create legitimacy. Legitimacy is stronger when the organisation can demonstrate how a specific use was configured, who authorised it, what evidence was captured, how outputs were checked, and how concerns could be reviewed or contested.

This makes organisational legitimacy closely related to, but distinct from, trust, legal compliance, and reputation. Trust can be informal and relational; compliance can be narrow and rule-based; reputation can be symbolic and externally managed. Legitimacy is broader and more governance-centred. It concerns whether the organisation can justify its conduct in a way that stands up to scrutiny across internal oversight, external review, and practical institutional expectations.

Within RAIDT, organisational legitimacy belongs in Star S2 because RAIDT treats governance as something that must be evidenced through oversight, control, accountability, reviewability, and continuous improvement. RAIDT's run-level evidence packs and five-pillar score profiles give legitimacy an operational basis. Instead of asking whether an organisation has a general AI policy, RAIDT asks whether a particular run can be reconstructed, assessed, challenged, and learned from. That is what makes legitimacy more than a vague ethical aspiration.

Why this concept matters

Organisational legitimacy matters because GenAI use in organisational work is often judged after the fact, under conditions of uncertainty, challenge, or harm. When a run produces a problematic output, stakeholders rarely accept a generic assurance that the system was used carefully. They ask what happened, what controls existed, who was responsible, and whether the organisation can show a review trail. RAIDT addresses that demand directly.

The concept also avoids a common confusion in AI governance: the idea that legitimacy comes from adopting principles, publishing policies, or asserting human oversight in the abstract. Those steps may help, but they do not resolve the evidential problem. If a run cannot be reconstructed and assessed, legitimacy remains fragile because the organisation cannot substantiate its claims when challenged.

Without legitimacy, organisations face avoidable governance risks: weak audit readiness, poor stakeholder confidence, regulatory vulnerability, internal defensiveness, and limited organisational learning. With legitimacy, organisations can show that GenAI use is not unmanaged experimentation but a governed practice supported by evidence, review, and improvement.

Key idea: Organisational legitimacy matters because RAIDT turns responsible-use claims into reviewable run-level evidence that can withstand scrutiny.

What this item enables

A defensible explanation of why a GenAI run was undertaken, by whom, and under what governance conditions.
A bridge between high-level governance principles and the inspectable evidence needed for practical accountability.
A basis for stakeholder confidence that rests on records, reviewability, and contestability rather than organisational assertion.
A way to connect individual runs to institutional trust, audit readiness, and governance maturity.
A repeatable mechanism for showing that responsible GenAI use is embedded in operations rather than treated as a communications claim.
A more credible interpretation of the RAIDT evidence pack and score profile as signs of governed organisational practice.

Practical example / likely audience question

Audience question

Why does this matter for managers?

Answer

The concern behind this question is usually pragmatic: managers are not only interested in abstract legitimacy theory, but in whether it helps them govern real systems under real scrutiny. The direct answer is that managers need legitimacy because they are the people most likely to be asked to justify how a GenAI-supported decision, draft, recommendation, or workflow was produced. If they cannot show a defensible record, they are left with little more than reassurance language.

A practical example is a manager whose team uses GenAI to draft client-facing communications. If an inaccurate or inappropriate message is later challenged, the manager must explain what model was used, what instructions were given, whether sensitive information was handled appropriately, whether a human reviewed the output, and what local controls were in place. RAIDT helps because it treats that event as a run with evidence, not as an informal act of tool use.

This is where RAIDT is stronger than a generic AI governance approach. A generic approach might say that the organisation has principles, training, and oversight committees. RAIDT adds run-level proof. It allows the manager to point to an evidence pack and score profile showing the specific governance conditions of the use in question. That makes legitimacy operational, defensible, and reviewable.

Practical example in RAIDT terms

Consider a local authority using a GenAI assistant to help draft housing support correspondence for vulnerable residents. The use case seems administratively modest, but the legitimacy stakes are high because the letters affect how the organisation is perceived by service users, elected members, oversight bodies, and the wider public.

The run-level issue arises when one drafted letter contains misleading wording about appeal options. The key governance question is not simply whether the organisation has an AI policy, but whether this specific run can be explained. RAIDT would require evidence such as the task purpose, prompt or instruction context, model or tool configuration, staff role, review steps, approval pathway, output version, and any correction or escalation record.

The most affected RAIDT pillars are Responsibility, Auditability, and Traceability, with strong secondary effects on Dependability and Interpretability. If the evidence pack shows that the run was properly scoped, reviewed, and logged, the organisation can demonstrate that the issue is governable and learnable rather than hidden or unmanaged. Organisational legitimacy is improved because the authority can show accountable use, explain the error pathway, and take corrective action with a documented basis.

Detailed link to RAIDT

Organisational legitimacy links to RAIDT in four ways.

First, it links to the core RAIDT idea that responsible GenAI governance should be evidenced at the level of actual use rather than described only in abstract principles or institutional claims.

Second, it links directly to the run because legitimacy becomes stronger when a specific run can be reconstructed in context: task, actor, tool configuration, controls, output, and review pathway.

Third, it links to the evidence pack and score profile because those outputs translate governance quality into inspectable artefacts. They show not just that governance exists, but how strongly it is supported across Responsibility, Auditability, Interpretability, Dependability, and Traceability.

Fourth, it links to reviewability, contestability, audit readiness, and organisational learning because legitimacy is maintained over time when decisions can be checked, challenged, and improved rather than merely defended.

Organisational legitimacy ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

This chain matters because RAIDT does not treat legitimacy as a symbolic outcome. It treats legitimacy as something earned when evidence enables credible review, informed challenge, and accountable improvement.

Link to the five RAIDT pillars

Responsibility

Organisational legitimacy is strongly shaped by whether responsibility for GenAI use is visible and allocable. If nobody can identify who initiated, reviewed, approved, or corrected a run, the organisation appears weakly governed.